3

I’m trying to capture frames sent and / or received by other clients on my wireless (WPA2-PSK) network. I installed Wireshark, activated the promiscuous mode and set the decryption key, but I’m unable to see frames other than my own… even when I associate another device to try and capture the authentication (EAPoL) handshake.

Do you have an idea why I can’t decrypt the frames?

Thanks.

  • Each client on a WPA2 (PSK) has their own handshake you won't be able to monitor any traffic except your own on an encrypted network – Ramhound Mar 4 '14 at 12:04
  • 1
    @Ramhound You're right that they have your own handshake, but wrong that you won't be able to monitor any traffic except your own. If you know the PSK and capture their handshake, you can decrypt their whole session. Wireshark.org even gives a tutorial with example captures on how to do this. – Spiff Mar 5 '14 at 3:33
5

Promiscuous mode is an Ethernet-level concept that should allow you to see other devices' data frames, but data frames are just one of several types of 802.11 frames. To see the other kinds of 802.11 frames (management, control, etc.), and possibly to see 802.11 headers, you need to use what's known as 802.11 Monitor Mode.

Then again, the EAPOL-Key frames used for the key handshake would be data frames, so if your 802.11 card/driver properly implemented Promiscuous mode, you should still be able to see them.

Another thing to be aware of is that 802.11 devices often transmit unicast data frames at the highest rate that the transmitter can transmit at, and that the receiver can receive at, given the technologies the transmitter and receiver support, and the RF conditions between them. So if your AP and the target laptop each have, say, a 3-stream 802.11ac card (capable of 1300mbps signaling with 80MHz-wide channels), and you Wireshark laptop only has a 2-stream card (only capable of rates up to 867Mbps), then you won't be able to capture any of the packets sent using 3-stream signaling.

Or if your AP and the target laptop are close to each other, where they can use their top rates, but your sniffer laptop is farther away where it doesn't get the signal-to-noise ratio it needs to successfully receive those signals, it won't see them.

Even if you put your sniffer machine halfway in between the AP and the target laptop, if the AP and the target laptop are doing beamforming, they beams they form may be taking paths that exclude your sniffer laptop.

  • So you think this is just a hardware issue and that the same procedure would work with another WiFi card? – simonsays9 Mar 5 '14 at 12:06
  • No, I think it could be a lot of different things, and you still have a lot of things to look into. It may be that you just need to use Monitor Mode (did you try that yet?). It could be a driver issue. It could be a hardware bug, or it could be that you don't have the right hardware on your sniffer to receive the kinds of Wi-Fi signals your other equipment is using. Or it could be a positioning issue. – Spiff Mar 5 '14 at 16:52
  • You could try connecting the AP to a wired network and listen to that :) – arni Oct 5 '15 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.